ConvertPlus
- Software type
- Other
- Total vulnerabilities (90 days)
- 1
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/07/2026, ConvertPlus recorded 1 security vulnerability in the last 90 days, of which 1 is rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of ConvertPlus and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-87741ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' ParameterCVE-2024-13800Popup Plugin For WordPress - ConvertPlus <= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options UpdateCVE-2024-4838ConvertPlus <= 3.5.26 - Authenticated (Contributor+) PHP Object InjectionCVE-2024-3240ConvertPlug <= 3.5.25 - Authenticated (Contributor+) PHP Object InjectionCVE-2024-3237ConvertPlug <= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-87741ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityHigh |
CVE-2024-13800Popup Plugin For WordPress - ConvertPlus <= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update | Exploitation statusNot exploited | FixYes | Published02/12/2025 | SeverityHigh |
CVE-2024-4838ConvertPlus <= 3.5.26 - Authenticated (Contributor+) PHP Object Injection | Exploitation statusNot exploited | FixYes | Published05/16/2024 | SeverityHigh |
CVE-2024-3240ConvertPlug <= 3.5.25 - Authenticated (Contributor+) PHP Object Injection | Exploitation statusNot exploited | FixYes | Published05/04/2024 | SeverityHigh |
CVE-2024-3237ConvertPlug <= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update | Exploitation statusNot exploited | FixYes | Published05/04/2024 | SeverityMedium |
5 Results | Page 1 of 1